Cloudflare OS: What Cloudflare Just Open-Sourced
Cloudflare open-sourced Cloudflare OS on August 5, 2026, under Apache 2.0. The framing in the press release is “the first AI workspace built around how companies actually work,” which sounds like every enterprise AI launch of the past year. The part worth reading is underneath the framing, in the access layer.
What it actually is
Cloudflare OS gives each person a browser-based workspace where agents do work: research, documents tied to live data, spreadsheets, deterministic workflows, and small internal apps. Every workspace is its own Durable Object, so it has real state rather than a chat history.
Agents get an isolated runtime to write and run code. The apps they produce are full stack, with client code for the browser and server code running on Dynamic Workers backed by SQLite. An app can be shared as a working tool or as a blueprint that someone else modifies, which is the difference between shipping a spreadsheet and shipping the thing that made it.
Curated company context and skills sit underneath all of it, so the agent starts from what your organization knows rather than from a blank prompt.
Gatekeepers are the interesting part
Every agent starts with zero access. Nothing is reachable until a Gatekeeper makes it reachable.
A Gatekeeper is a service-specific Worker that sits between an agent and an external system. It handles the OAuth dance, holds the credential so the agent never sees it, enforces policy, records what was read, and mediates anything with an externally visible side effect. Cloudflare’s example is granting access to one repository rather than an entire GitHub account, which is the granularity most credential-sharing schemes never reach.
The recording matters more than it sounds. Cloudflare OS tracks every resource an agent observes and attaches those observations to the work product. When a workspace is shared, access is verified against the recipient rather than assumed from the sharer, so a document assembled from a system you can see does not silently leak to someone who cannot see it. That is the failure mode that has quietly sunk a lot of internal AI rollouts.
The access ceiling is explicit: a user session in Cloudflare OS is scoped to that person’s existing permission set in each system of record. Nobody gets more through the agent than they hold directly.
The rest of the plumbing is existing Cloudflare product. Access controls entry to the platform. AI Gateway routes every inference, which is where administrators see spend and set budgets and rate limits. MCP servers connect through MCP Server Portals. Outbound networking is off by default, so an agent reaches the outside world only through capabilities you granted.
What Cloudflare says its own use looks like
Cloudflare ran this internally before releasing it, and published numbers rather than adjectives.
Thousands of team members use it weekly, with daily actives growing every workday. In one 30-day window, staff created over 4,000 apps and tools, and sales teams recorded more than 10,000 hours saved on manual work like territory planning and proposal creation. Over four months, automated code review agents flagged nearly a quarter of a million potential problems, blocked 16,000 merges, and caught architectural issues in close to 600 designs before code was written.
Treat these as vendor figures, because they are. What they do establish is that the non-engineering half of the company used it, which is the claim most internal AI platforms cannot make.
What it costs
There is no license fee. The cost is whatever the deployment consumes on Cloudflare: Workers and Durable Objects for the workspaces, Dynamic Workers for the apps agents build, and model tokens for every inference through AI Gateway. The Workers Paid plan starts at $5 per month and covers Workers, Durable Objects, KV, and Hyperdrive together, so the platform floor is small and inference is the line item that actually moves.
Cloudflare says a fully managed version is coming to the dashboard. Until then, the honest description of the price is “your Cloudflare bill plus your model bill,” and the model bill dominates.
The rough edges Cloudflare admits to
The README calls the August 2026 release “very capable, but still has many rough edges” and asks you to treat it as early access. This is v2, a complete rewrite, in heavy development.
Concretely: containers are not supported yet, search is temporarily unavailable, and it does not live in Slack or other chat tools yet, though that is on the roadmap. Local development is a pnpm run-local away, and there is a guided deploy flow for pushing it into your own Cloudflare account. Presidio and Happy Cog are named as implementation partners, which tells you the intended buyer has an IT organization.
Who this is for
Cloudflare OS is a deployment, not a signup. Someone has to stand it up, wire OAuth credentials for each connected service, write or configure Gatekeepers for internal systems, and own the thing afterward. In exchange you get an AI workspace where your data stays in your account, the access model is enforced rather than promised, and the apps your team builds are yours.
If your company already runs on Cloudflare and has an internal platform team, that trade is good. If you are a small team that wants an agent working this week, it is the wrong shape entirely, and the equivalent effort is better spent on something that starts from your existing accounts.
That is the gap Carly fills: an assistant that already watches your inbox and calendar and acts when something arrives, with no deployment step. Free Zapier-style workflows, with AI agents from $35/month. Driving it from your own code or provisioning agents per tenant is available too, so if you want the platform shape without the platform project, book a call with the team.
For builders who want the primitives rather than the workspace, Cloudflare’s Agents SDK is the other half of this story and predates Cloudflare OS by several months.
FAQ
Is Cloudflare OS free?
The software is free and open source under Apache 2.0. Running it is not: you pay for Workers, Durable Objects, and every model call routed through AI Gateway. The Workers Paid plan starts at $5 per month, and inference costs dominate from there.
Do I need a Cloudflare account to use it?
To deploy it for real, yes, and the guided flow deploys into your own account. You can run it locally first with pnpm. Cloudflare notes that being built on Workers does not mean it can only run on Cloudflare, since the runtime, workerd, is itself open source.
Is Cloudflare OS a chatbot for Slack?
No. It is a browser workspace. Cloudflare has said bringing workspaces into Slack and other chat tools is future work, so today the agent does not live where your team talks.
How is this different from the Cloudflare Agents SDK?
The Agents SDK is a TypeScript toolkit for developers building their own agents on Workers. Cloudflare OS is an application built for employees, with a workspace UI, a permission framework, and an app builder on top.
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
